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WHAT IS CLAIMED IS: 

1 . A method of processing runtime functions, comprising: 

receiving a call to a runtime function; 

determining associated data from the call to the runtime function; 
determining a target from the associated data; and 
executing the target. 

2. The method of claim 1, wherein the step of determining the associated data comprises 
accessing data in a data structure connected with the runtime function and calculating the 
associated data based on the accessed data. 

3. The method of claim 1, further comprising: 

determining if at least a portion of the associated data is valid; and 
preventing execution of the target if the associated data is not valid. 

4. The method of claim 3, further comprising maintaining a list of valid targets, wherein the step 
of determining if the associated data is valid comprises comparing the target to the list of valid 
targets. 

5. The method of claim 4, wherein maintaining the list comprises generating the list of valid 
targets at compiler and link time. 

6. The method of claim 4, wherein maintaining the list comprises generating the list of valid 
targets at runtime. 

7. The method of claim 3, wherein the step of determining if the associated data is valid 
comprises retrieving a security cookie from the associated data and comparing the retrieved 
security cookie to a list of valid security cookies. 
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8. The method of claim 3, further comprising determining and storing a predetermined 
calculated value based on at least a portion of the associated data, prior to receiving the call to 
the runtime function. 

9. The method of claim 8, wherein determining if the associated data is valid comprises 
comparing the predetermined calculated value to another calculated value based on the 
associated data. 

10. A computer-readable medium having stored thereon computer-executable instructions for 
performing a method of processing runtime functions, the method comprising: 

receiving a call to a runtime function; 

determining associated data from the call to the runtime function; 
determining a target from the associated data; and 
executing the target. 

1 1 . The computer readable medium of claim 10, wherein the step of determining the associated 
data comprises accessing data in a data structure connected with the runtime function and 
calculating the associated data based on the accessed data. 

12. The computer readable medium of claim 10, having further computer-executable 
instructions for determining if at least a portion of the associated data is valid, and preventing 
execution of the target if the associated data is not valid. 

13. The computer-readable medium of claim 12, having further computer-executable 
instructions for maintaining a list of valid targets, wherein the step of determining if the 
associated data is valid comprises comparing the target to the list of valid targets. 

14. The computer-readable medium of claim 13, wherein maintaining the list comprises 
generating the list of valid targets at compiler and link time. 
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15. The computer-readable medium of claim 13, wherein maintaining the list comprises 
generating the list of valid targets at runtime. 

16. The computer-readable medium of claim 12, wherein determining if the associated data is 
valid comprises retrieving a security cookie from the associated data and comparing the retrieved 
security cookie to a list of valid security cookies. 

17. The computer-readable medium of claim 12, having further computer-executable 
instructions for determining and storing a predetermined calculated value based on at least a 
portion of the associated data, prior to receiving the call to the runtime function. 

18. The computer-readable medium of claim 17, wherein determining if the associated data is 
valid comprises comparing the predetermined calculated value to another calculated value based 
on the associated data. 

19. A system for processing runtime functions, comprising: 

a processor that receives a call to a runtime function; and 

a dispatcher system that determines associated data from the call to the runtime function, 
determines a target from the associated data, and executes the target. 

20. The system of claim 19, wherein the dispatcher system comprises a module to access data in 
a data structure connected with the runtime function and calculate the associated data based on 
the accessed data. 

21. The system of claim 19, wherein the dispatcher system comprises modules to determine if at 
least a portion of the associated data is valid and prevent execution of the target if the associated 
data is not valid. 

22. The system of claim 21, further comprising a storage device that stores a list of valid targets, 
wherein the dispatcher system determines if the associated data is valid by comparing the target 
to the list of valid targets. 
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23. The system of claim 22, further comprising a compiler that generates the list of valid targets. 

24. The system of claim 21, wherein the dispatcher system determines if the associated data is 
valid by retrieving a security cookie from the associated data and comparing the retrieved 
security cookie to a list of valid security cookies. 

25. The system of claim 21, wherein the processor determines and stores a predetermined 
calculated value based on at least a portion of the associated data, prior to receiving the call to 
the runtime function. 

26. The system of claim 25, wherein the dispatcher system determines if the associated data is 
valid by comparing the predetermined calculated value to another calculated value based on the 
associated data. 

27. The system of claim 19, further comprising a compiler and a linker that compiles code to 
produce an executable that is marked with an identifier indicating that the executable supports 
runtime protection. 



